
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@uh-joan/offx-mcp-server
Advanced tools
OFF-X (Target Safety) MCP server for drug safety, adverse event, and target risk analytics.
MCP Server for searching drugs, adverse events, alerts, and scores in the OFFX (Target Safety) database.
# Using npm (if published)
npm install @uh-joan/offx-mcp-server
OFFX_API_TOKEN=your_offx_api_token
USE_HTTP=true # Optional: run as HTTP server
PORT=3000 # Optional: specify port for HTTP server
# As MCP server
npx offx-mcp-server
# As HTTP server
USE_HTTP=true PORT=3000 npx offx-mcp-server
The following types are OFFX-API compatible:
Field | Format | Comments |
---|---|---|
dates | yyyy-mm-dd | Specification ISO 8601 |
strings | String | No quotes needed in JSON |
numbers | Integer | Only accepts integers |
The following filters are OFFX-API compatible. For fields that accept multiple values, use comma-separated numbers (e.g., adverse_event_id=10000059,10000081
).
Field | Format | Allowed Values/Comments |
---|---|---|
Adverse Event | Comma separated number | Example: adverse_event_id=10000059,10000081,10001761 |
Alert Type | Comma separated number | 1 - Class Alert, 2 - Drug Alert |
Alert Phase | Comma separated number | 1 - Clinical/Postmarketing, 2 - Preclinical, 3 - Clinical, 4 - Postmarketing, 5 - Target Discovery, 6 - Phase I, 7 - Phase II, 8 - Phase III, 9 - Phase IV, 10 - Phase I/II, 11 - Phase II/III, 12 - Phase III/IV |
Reference source type | Comma separated number | 9 - Congress, 10 - Website Reference, 11 - Company Communication, 27 - Health Organization, 24 - Database, 22 - DailyMed, 23 - Regulatory Agency Briefing, 25 - Patent, 12 - Medical Society Communication, 13 - Research Institution Communication, 14 - Regulatory Agency Communication, 15 - Regulatory Agency Guideline, 16 - Patient Advocacy Group communication, 17 - Other, 18 - Book, 19 - Journal, 20 - Congress Alert, 21 - Congress & Conferences, 26 - Clinical Trial Registry |
Level of evidence | Comma separated number | 1 - Confirmed/Reported, 2 - Suspected, 3 - Refuted/Not Associated |
On/Off Target | Comma separated number | 1 - On-Target, 2 - Off-Target, 3 - Not Specified |
Alert Severity | String | yes, no |
Ordering | String | order_by_date=desc/asc, order_by_adv=desc/asc |
Refer to these tables when using filter parameters in the endpoints below.
offx_search_drugs
{ drug: string }
{ "drug": "everolimus" }
offx_get_drug_alerts
{ "drug_id": "140448", "alert_type": "serious" }
offx_get_drugs_by_action
{ target_id: string, action_id: string }
offx_get_drugs_by_adve
{ adverse_event_id: string, page?: number }
offx_get_drug_score
{ drug_id: string, adverse_event_id?: string }
offx_search_adverse_events
{ adverse_event: string }
{ "adverse_event": "Anaemia" }
offx_get_adverse_events
{ drug_id?: string, target_id?: string }
offx_search_targets
{ target: string }
{ "target": "ALK" }
offx_get_drug
offx_get_target
offx_get_targets
{ drug_id?: string, type?: "primary"|"secondary", adverse_event_id?: string }
When running in HTTP mode (USE_HTTP=true
), the following REST endpoints are available. All endpoints accept a POST request with a JSON body as described below:
POST /offx_search_drugs
{ "drug": "semaglutide" }
POST /offx_get_drug_alerts
{ "drug_id": "140448", "alert_type": "serious" }
POST /offx_get_drugs_by_action
{ "target_id": "12345", "action_id": "67890" }
POST /offx_get_drugs_by_adve
{ "adverse_event_id": "12345" }
POST /offx_get_drug_score
{ "drug_id": "140448" }
POST /offx_search_adverse_events
{ "adverse_event": "Anaemia" }
POST /offx_get_adverse_events
{ "drug_id": "140448" }
POST /offx_search_targets
{ "target": "ALK" }
POST /offx_get_drug
{ "drug_id": "140448", "page": 1 }
POST /offx_get_target
{ "target_id": "12345", "action_id": "67890", "page": 1 }
POST /offx_get_targets
{ "drug_id": "140448", "type": "primary" }
The server requires an OFFX API token:
OFFX_API_TOKEN=your_offx_api_token
Before starting make sure Node.js is installed on your desktop for npx
to work.
Go to: Settings > Developer > Edit Config
Add the following to your claude_desktop_config.json
:
{
"mcpServers": {
"offx": {
"command": "npx",
"args": [
"-y",
"@uh-joan/offx-mcp-server"
],
"env": {
"OFFX_API_TOKEN": "your_offx_api_token"
}
}
}
}
git clone https://github.com/uh-joan/offx-mcp-server.git
cd offx-mcp-server
npm install
npm run build
For local development:
# Copy example environment file
cp .env.example .env
# Edit .env with your credentials
vim .env # or use your preferred editor
# Start the server
npm run start
docker build -t offx-mcp-server .
docker run -i --env-file .env offx-mcp-server
This MCP server is licensed under the MIT License.
OFF-X™ is a commercial product and trademark of Clarivate Analytics. This MCP server requires valid OFF-X API credentials to function. To obtain credentials and learn more about OFF-X, please visit Clarivate's OFF-X page.
This project is not affiliated with, endorsed by, or sponsored by Clarivate Analytics. All product names, logos, and brands are property of their respective owners.
Contributions are welcome! Please feel free to submit a Pull Request. For major changes, please open an issue first to discuss what you would like to change.
Note: For
alert_type
, use only numeric codes as a string:
Code Alert Type 1 Class Alert 2 Drug Alert You can specify more than one, e.g.
"alert_type": "1,2"
.
FAQs
OFF-X (Target Safety) MCP server for drug safety, adverse event, and target risk analytics.
We found that @uh-joan/offx-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.